6e6bce035a03f863319c55d344ea7b901de2838b5531d93140ea729424a45d30

General

Target

72ac9ab1e365c396845fa33f839a9366_JaffaCakes118.exe
Size

224KB
MD5

72ac9ab1e365c396845fa33f839a9366
SHA1

ae27897619c24f4033a4ca6c56c94e65a39d667a
SHA256

6e6bce035a03f863319c55d344ea7b901de2838b5531d93140ea729424a45d30
SHA512

09b0c819b9113ed5c856615ab20177f7c74442de4a8ff77d11651db59615b638b574b2861c564fed92345b920a41ce073b9950f4e2f57b6f6d3446a4a2957736
SSDEEP

6144:9OZvNXWnH4fN0jc3tA8Mn0+JgS0Ig/eUvYfdo1C7kblu6l:9OZVXWnH4fNOc+0GIIPUwfS1PZjl

Score

10^/10

discovery evasion

Malware Config

Signatures

Modifies firewall policy service 3 TTPs 18 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile	72ac9ab1e365c396845fa33f839a9366_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\Logging	72ac9ab1e365c396845fa33f839a9366_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\GloballyOpenPorts	72ac9ab1e365c396845fa33f839a9366_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\AuthorizedApplications	72ac9ab1e365c396845fa33f839a9366_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts	72ac9ab1e365c396845fa33f839a9366_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts	72ac9ab1e365c396845fa33f839a9366_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	72ac9ab1e365c396845fa33f839a9366_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Static\System	72ac9ab1e365c396845fa33f839a9366_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications	72ac9ab1e365c396845fa33f839a9366_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\Logging	72ac9ab1e365c396845fa33f839a9366_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Static	72ac9ab1e365c396845fa33f839a9366_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices	72ac9ab1e365c396845fa33f839a9366_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\PublicProfile	72ac9ab1e365c396845fa33f839a9366_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules	72ac9ab1e365c396845fa33f839a9366_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\Logging	72ac9ab1e365c396845fa33f839a9366_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	72ac9ab1e365c396845fa33f839a9366_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Configurable\System	72ac9ab1e365c396845fa33f839a9366_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Configurable	72ac9ab1e365c396845fa33f839a9366_JaffaCakes118.exe

Modifies security service 2 TTPs 4 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Security	72ac9ab1e365c396845fa33f839a9366_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Parameters	72ac9ab1e365c396845fa33f839a9366_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Security	72ac9ab1e365c396845fa33f839a9366_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Parameters	72ac9ab1e365c396845fa33f839a9366_JaffaCakes118.exe

Deletes itself 1 IoCs

pid	Process
1676	cmd.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\bs.dll	72ac9ab1e365c396845fa33f839a9366_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\sclb.dll	72ac9ab1e365c396845fa33f839a9366_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\schedsvc.dll	72ac9ab1e365c396845fa33f839a9366_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\ud.bat	72ac9ab1e365c396845fa33f839a9366_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	72ac9ab1e365c396845fa33f839a9366_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2500	72ac9ab1e365c396845fa33f839a9366_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2500	72ac9ab1e365c396845fa33f839a9366_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2500 wrote to memory of 376	2500	72ac9ab1e365c396845fa33f839a9366_JaffaCakes118.exe	17
PID 2500 wrote to memory of 1676	2500	72ac9ab1e365c396845fa33f839a9366_JaffaCakes118.exe	30
PID 2500 wrote to memory of 1676	2500	72ac9ab1e365c396845fa33f839a9366_JaffaCakes118.exe	30
PID 2500 wrote to memory of 1676	2500	72ac9ab1e365c396845fa33f839a9366_JaffaCakes118.exe	30
PID 2500 wrote to memory of 1676	2500	72ac9ab1e365c396845fa33f839a9366_JaffaCakes118.exe	30
PID 2500 wrote to memory of 1676	2500	72ac9ab1e365c396845fa33f839a9366_JaffaCakes118.exe	30
PID 2500 wrote to memory of 1676	2500	72ac9ab1e365c396845fa33f839a9366_JaffaCakes118.exe	30
PID 2500 wrote to memory of 1676	2500	72ac9ab1e365c396845fa33f839a9366_JaffaCakes118.exe	30

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:376

C:\Users\Admin\AppData\Local\Temp\72ac9ab1e365c396845fa33f839a9366_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\72ac9ab1e365c396845fa33f839a9366_JaffaCakes118.exe"
1⤵
- Modifies firewall policy service
- Modifies security service
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2500
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\system32\ud.bat
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:1676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Privilege Escalation

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\ud.bat

Filesize
350B

MD5
37def36b8911f1f145620eed74e1b089

SHA1
4efc4f67e82f14525565b5a72276c2196d572bbc

SHA256
689f8eb41c888588c342bf9cab95cf5b74b0f61c12d75493f7d387d25ee91501

SHA512
1260fce52601816e4c8585a56514c9f5270c9f2c4b3eee789c9f4ee6490918d134e6785b020e1660035fac458b7a1e1c7b29554c9703fcae2f9985472e833c3b

Download Submit
memory/376-4-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads